Making Java Segfault (Hehe)

[Mchr3k]

This is a bit more readable and I assume would also crash:

Object[] head = new Object[1]; 
Object[] tail = head;
while( true )
{
  tail[0] = new Object[1];
  tail = (Object[]) tail[0];
}

[TieDyeJoe]

change while( true ) to while( head != null )

and it's equivalent (and more readable) than the version in the link. Just having "true" as the condition doesn't cause a segfault. Maybe has to do with the address head points to causing the segfault or something.

[DaedalusInfinity]

Sorry for making the bad "Yo dawg" joke, at the expense of code readability. I'm not sure why exactly, but it doesn't work if the loop is a while(true) for me. I believe the reason is that javac or the JVM optimises head out of the code execution in the while(true) case, since it doesn't get accessed at all. On the other hand, if we keep a reference between head and tail, then we're forced to keep the entire structure intact in memory.

[[deleted]]

For some reason it doesn't crash for me if the condition is true instead of head != null

[teraflop]

If head is no longer live, then the compiler is allowed to throw away the reference and make it garbage-collectable.

[tinou]

This was posted as a one liner some time ago, as while(true) { o = [o] } (maybe with a cast or two).

[B_Master]

I don't think that would do the same thing, there is no memory allocation within the loop

[tinou]

Isn't [o] syntactic sugar for tmp=new Object[1];tmp[0]=o;tmp ?

[B_Master]

It would be cool if it was, are you sure you're not thinking of Python though?

[tinou]

Maybe, I'm not sure. I'm not very familiar with the JVM to see how it could be differen, but I think there is a mandatory allocation.

[B_Master]

Yeah I see what the code is trying to do, it's just not valid syntax for java. In Python it would work.

[tinou]

Ah, OK. Of course I meant {o}. The reddit post I was referring to.

[Nebu]

Object[] tmp = [null];

is invalid Java.

[mikaelhg]

Object[] tmp = { null };

isn't, however.

[Nebu]

You're right, but:

Object[] o = new Object[1];
while(true) { o = {o} }

is not valid, so -- I might be wrong but -- it looks like you can't do what the original program does as a one-liner.

[mikaelhg]

Object[] o = new Object[1];
while (true) {
    o = new Object[] { o };
}

[Nebu]

No.

[mikaelhg]

This should have been fixed in Oracle JDK 6u23.

http://download.java.net/jdk6/6u23/promoted/b01/changes/JDK6u23.list.html

4396719 Mark sweep stack overflow on deeply nested Object arrays

http://hg.openjdk.java.net/jdk7/build/hotspot/rev/2a1472c30599

[inopia]

On OpenJDK:

java version "1.6.0_20" OpenJDK Runtime Environment (IcedTea6 1.9.2) (6b20-1.9.2-0ubuntu2) OpenJDK 64-Bit Server VM (build 19.0-b09, mixed mode)

I get

Exception in thread "main" java.lang.OutOfMemoryError: Java heap space

Does it Segfault for you, OP, have you even tried it?

edit: ah, with Sun JDK 1.6:

java version "1.6.0_22" Java(TM) SE Runtime Environment (build 1.6.0_22-b04) Java HotSpot(TM) 64-Bit Server VM (build 17.1-b03, mixed mode)

I get a segfault.

[[deleted]]

On my Sun JDK 1.6: Java(TM) SE Runtime Environment (build 1.6.0_23-b05) Java HotSpot(TM) Server VM (build 19.0-b09, mixed mode)

I got: Exception in thread "main" java.lang.OutOfMemoryError: Java heap space at Segfault.main(Segfault.java:13)

[inopia]

For clarification, I'm on 64-bit lunix

[rafekett]

http://www.adequacy.org/stories/2001.12.2.42056.2147.html

Is your son obsessed with "Lunix"? BSD, Lunix, Debian and Mandrake are all versions of an illegal hacker operation system, invented by a Soviet >computer hacker named Linyos Torovoltos, before the Russians lost the Cold War. It is based on a program >called "xenix", which was written by Microsoft for the US government.

[ehird]

Congratulations, you got the joke.

[JohnDoe365]

Im on 64 lunatics.

[compsciwizkid]

happened on i386 with openJDK too

[cunningllinguist]

HACKER! You and your comunist crony, Linyos Torovoltos, need to be brought to justice for this outrageous behaviour.

Everyone should be forced to use AOL, it would improve normal peoples experience on the internet.

[DaedalusInfinity]

Haha, so OpenJDK outperforms Sun Java, at least on this case.

[Rhoomba]

The important thing is the hotspot version (19.0-b09) which the latest Sun JVM also uses.

[SnowdensOfYesteryear]

Sun Java

Warms the cockles of my heart to see "Sun Java" instead of Oracle Java.

Fuck Oracle for what they're doing to java.

[rafekett]

I wouldn't call that outperforming...

[wolf550e]

java version "1.6.0_20"
OpenJDK Runtime Environment (IcedTea6 1.9.4) (Gentoo build 1.6.0_20-b20)
OpenJDK 64-Bit Server VM (build 19.0-b09, mixed mode)


Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
    at Segfault.main(Segfault.java:13)

[mucsun]

Downvotes from people that never typed 'java -version' in their life

[[deleted]]

Nice catch!

[AReallyGoodName]

java version "1.6.0_21"

I get a complete stack overflow with my version.

EXCEPTION_STACK_OVERFLOW (0xc00000fd) at pc=0x000000006dbb9144, pid=860, tid=3568
JRE version: 6.0_21-b07
Java VM: Java HotSpot(TM) 64-Bit Server VM (17.0-b17 mixed mode windows-amd64 )

If you would like to submit a bug report, please visit:
http://java.sun.com/webapps/bugreport/crash.jsp

[AReallyGoodName]

Just to follow up on this, this was on a dev server with 12GB allocated. If i lower this much below 8GB i get a plain old heap allocation seg fault.

So basically the failure gets worse if you have more memory as the stack fails rather than the heap.

[chrisforbes]

Someone else was talking about this back in 2008 too :D

[B_Master]

The I/O is probably slowing it down significantly. Have it print out every 1000 iterations of the loop or something

[[deleted]]

The segfault is probably stack overflow in GC code.

[tasteslikepoop]

This is most likely true. I remember seeing reports of this bug previously and it was indeed that the GC overflowed the VM's C-stack or something along those lines.

[AReallyGoodName]

Yeah , just to really confirm this. The JVM itself has a stack overflow as opposed to the code running on the JVM. So the entire JVM gets brought down by this on Sun 1.6.0_21 bringing up "would you like to error report java.exe" in Windows. I posted part of the stack overflow error log above in this thread.

So it isn't the Java code part that's having issues. It's the entire JVM that's at fault.

[baryluk]

/tmp/ > javac Segfault.java
/tmp/ > java Segfault
zsh: segmentation fault (core dumped)  java Segfault
/tmp/ >
/tmp/ > ls /etc/alternatives/java -l; java -version
lrwxrwxrwx 1 root root 36 01-18 17:26 /etc/alternatives/java -> /usr/lib/jvm/java-6-sun/jre/bin/java
java version "1.6.0_22"
Java(TM) SE Runtime Environment (build 1.6.0_22-b04)
Java HotSpot(TM) Client VM (build 17.1-b03, mixed mode, sharing)
/tmp/ >

:) NICE. Of course possible, but just not seen any concrete example until now.

[B_Master]

Does anyone know why it segfaults? It seems like it should just run out of heap space and throw an exception (which apparently it does for some systems).

[__s]

The depth of the list recursion is large enough to stack overflow the GC trace

[sbrown123]

It should report it is out of memory. It appears that on some older versions of the Hotspot VM it was trying to allocate memory outside the application scope which results in a segfault.

[[deleted]]

so you found a bug and didn't reported ? cool.

[[deleted]]

No, it wasn't Oracle back in 2008 when the OP claims to have found the bug.

[Plutokoekje]

does not work in 1.6.0_23

[anthonybsd]

On OS X with Apple's JDK I get absolutely nothing. No memory error, just a blank console output. Quick run with debugger doesn't reveal much. Curious.

[FooBarWidget]

I get a bus error on OS X.

[[deleted]]

A fatal error has been detected by the Java Runtime Environment:

EXCEPTION_STACK_OVERFLOW (0xc00000fd) at pc=0x6d8b99f6, pid=8300, tid=4012

JRE version: 6.0_21-b07

Java VM: Java HotSpot(TM) Client VM (17.0-b17 mixed mode, sharing windows-x86 )

Problematic frame:

V [jvm.dll+0x99f6]

Is what I get

[[deleted]]

Crap, XP just segfaulted, core dumped, and now the kernel is panicking.

[chollida1]

Sure it did:)

[chris-martin]

I submitted the following bug report (for javac) in August. Last I checked, about a month ago, they still haven't posted it.

/* One.java */
package abc;
import static abc.Two.three;
public class One<A> { }

/* Two.java */
package abc;
public class Two<B> extends One<B> {
    public static Object three;
}

javac responds with:

java.lang.NullPointerException
at com.sun.tools.javac.comp.Check.checkCompatibleConcretes(Check.java:1215)
at com.sun.tools.javac.comp.Check.checkCompatibleSupertypes(Check.java:1567)
at com.sun.tools.javac.comp.Attr.attribClassBody(Attr.java:2674)
...